cells: get only user visible content in placeholders (#19939)

combo/public/templatetags/combo.py

@@ -58,7 +58,8 @@ def placeholder(context, placeholder_name, **options):
         page_cells = context['page'].get_cells() if 'page' in context else []
     context['cells'] = [x for x in page_cells if
             x.placeholder == placeholder_name and
-            (context.get('render_skeleton') or x.is_relevant(context))]
+            (context.get('render_skeleton') or x.is_relevant(context) and
+            x.is_visible(context.request.user))]
     if context.get('render_skeleton') and not context['cells']:
         context['skeleton'] = skeleton_text(context, placeholder_name)
     else:

tests/test_cells.py

@@ -15,6 +15,8 @@ from django.core.urlresolvers import reverse
 
 from combo.utils import NothingInCacheException
 
+from test_manager import admin_user, login
+
 pytestmark = pytest.mark.django_db
 
 
@@ -584,3 +586,29 @@ def test_config_json_cell_additional_url(app):
             assert context['plop2_url'] == ''
             assert 'plop2_status' not in context
             assert 'plop2_error' not in context
+
+
+def test_page_cell_placeholder_restricted_visibility(app, admin_user):
+    page = Page(title='Test', slug='test', template_name='standard')
+    page.save()
+    json_cell = JsonCell(page=page, placeholder='content', order=0, url='http://example.com')
+    json_cell.template_string = '{% load combo %}{% placeholder "foobar" name="Foobar" %}'
+    json_cell.save()
+
+    TextCell(page=page, placeholder='foobar', text='<p>Public text</p>', order=0,
+             restricted_to_unlogged=True).save()
+    TextCell(page=page, placeholder='foobar', text='<p>Private text</p>',
+             order=1, public=False).save()
+
+    resp = app.get(reverse('combo-public-ajax-page-cell',
+                           kwargs={'page_pk': page.pk, 'cell_reference': json_cell.get_reference()}))
+
+    assert "<p>Public text</p>" in resp.content
+    assert "<p>Private text</p>" not in resp.content
+
+    app = login(app)
+    resp = app.get(reverse('combo-public-ajax-page-cell',
+                    kwargs={'page_pk': page.pk, 'cell_reference': json_cell.get_reference()}))
+
+    assert "<p>Public text</p>" not in resp.content
+    assert "<p>Private text</p>" in resp.content

tests/test_manager.py

@@ -615,7 +615,7 @@ def test_page_multiple_link_cells(app, admin_user):
 def test_page_cell_placeholder(app, admin_user):
     page = Page(title='One', slug='one', template_name='standard')
     page.save()
-    cell = JsonCell(page=page, placeholder='content', order=0)
+    cell = JsonCell(page=page, placeholder='content', order=0, url='http://example.com')
     cell.save()
 
     app = login(app)